---
title: "Interveil Model Decision — Provider-Neutral Core, Inkling in Shadow, Tinker After Labels"
decision: "ADR-001"
date: "2026-08-18"
status: "Accepted for Alpha"
---

# Interveil Model Decision

## Decision

Use a **provider-neutral model registry**, with **Inkling-Small as the first multimodal proposal model in shadow mode** and **Tinker as the later post-training path** once Interveil has a defensible human-reviewed dataset.

This is not a choice between a multi-model library and Thinking Machines. The library is the control plane; Inkling is one model behind it; Tinker is the training and evaluation path. None of them receives canonical write authority.

For the public Alpha, the capture workbench remains deterministic and local-only. Model-assisted capture is introduced only behind a separate disclosure and explicit action.

## Name correction

The Thinking Machines model is **Inkling**, not “Inking.” Inkling was released on July 15, 2026, and the current Apache 2.0 open-weight family includes Inkling-Small. Both accept text, image, and audio inputs. Inkling-Small is a 276B-total, 12B-active mixture-of-experts model; the full Inkling model is 975B total and 41B active.

## Why this architecture

### Tinker is a training platform first

Tinker exposes LoRA post-training, sampling, evaluation, checkpoint export, and open-model support. Its own documentation describes the OpenAI-compatible endpoint as beta, intended for testing and internal low-traffic workflows rather than high-throughput user-facing deployment. Its serverless inference offering is also beta and not recommended for intensive production use.

That makes Tinker an unusually good fit for Interveil's later verifier and extraction specialization, but a poor single point of dependency for the public runtime today.

### Inkling-Small fits the proposal boundary

It accepts text, images, and audio; has open weights; can be fine-tuned on Tinker; and is materially cheaper and lower-latency than the full model. Those properties align with Interveil's capture side: transcripts, scans, photographs, and instrument output can share one proposal interface.

The model card also states familiar foundation-model limitations, including hallucination and uneven performance, and recommends use-case evaluation and human oversight. Interveil therefore treats every output as a proposal, not a record.

### The application must remain portable

A provider registry lets the product assign named roles—extractor, verifier, renderer—without hard-coding one vendor. The current TypeScript application can use the Vercel AI SDK's provider registry and structured-output support; its OpenAI-compatible provider can point at Tinker's compatible endpoint for internal evaluation. The same contract can route a second, independently selected verifier to another provider.

Portability is epistemically useful, not merely commercial. A verifier from the same model family can share the extractor's failure modes. Provider and model diversity gives Interveil a way to measure correlated errors rather than assuming independence.

## Model roles

| Role | Alpha choice | Authority | Required output |
|---|---|---|---|
| Segmenter | Deterministic local rules | Proposal only | Exact source spans |
| Multimodal extractor | Inkling-Small, shadow mode | Proposal only | Atomic candidates, role/status suggestion, exact selectors |
| Evidence-bearing classifier | Second independently benchmarked model | Advisory only | `supports`, `partial`, `contradicts`, `context`, or `none` with rationale |
| Echo detector | MinHash/near-duplicate + embeddings; model for adjudication hints | Advisory only | Candidate dependency edges and assessability |
| Lens renderer | Best benchmarked model for the declared lens | Render only | Answer contract plus complete sentence receipts |
| Canonical writer | Human reviewer | Sole authority | Accepted nodes and signed revision |

## Rollout

### Alpha 0 — now

- Keep source capture local.
- Use deterministic sentence segmentation.
- Require human acceptance before local JSON-LD export.
- Collect only separately consented, de-identified product signals.
- Build the validator and evaluation harness before adding generation.

### Alpha 1 — shadow evaluation

- Add Inkling-Small behind a provider registry.
- Run it only when a reviewer chooses model assistance.
- Store prompt, model, version, parameters, input hashes, output, latency, and cost in a model receipt.
- Compare its candidates against human encodings without writing to the packet.
- Route difficult or low-agreement cases to a second model and then to human adjudication.

### Beta — task-specific post-training

Use Tinker LoRA only after the project has a diverse, rights-cleared set of accepted, edited, and rejected candidates from at least three domains. Train for narrow tasks such as atomic segmentation, node-role suggestion, evidence-bearing classification, and omission detection—not for truth scoring.

Every checkpoint must have a dataset manifest, code revision, base-model identifier, hyperparameters, evaluation report, safety notes, and supersession reason. Exportable weights are a useful hedge against runtime lock-in.

## Evaluation suite

Hold out packets by domain and source root. Do not split near-duplicate passages across train and test.

Measure:

- exact-selector precision and recall;
- atomicity violation rate;
- primary-role macro F1 before adjudication;
- epistemic-status accuracy;
- evidence-bearing accuracy, with `partial` measured separately;
- dependency-candidate precision and recall;
- unsupported span rate;
- omission and qualification preservation;
- forbidden-collapse rate;
- reviewer accept, edit, reject, and adjudication time;
- latency and cost by model role; and
- agreement and correlated-error rate across model families.

Promotion gates:

- zero autonomous canonical writes;
- zero critical forbidden-collapse failures in the release suite;
- at least 95% complete claim traces for accepted summary sentences;
- model assistance reduces median encoding time without lowering reviewer agreement; and
- no external-source processing without the declared consent and retention policy.

## Privacy and data governance

Thinking Machines documents organization and project isolation, but its public privacy notice permits collection and use of service information to provide, analyze, and improve services and does not by itself establish the contract Interveil needs for sensitive user material.

Before external model processing of private source content, Interveil should obtain service-specific answers on retention, training use, deletion, subprocessors, incident response, regional processing, and a DPA. Until then:

- local-only remains the default;
- external processing is a separate, explicit choice;
- the disclosure names provider, model, purpose, content sent, and retention terms;
- packet data and product telemetry stay in separate stores; and
- feedback never contains source content by default.

## Runtime contract

Every model call returns or is wrapped in:

```json
{
  "task": "atomic-extraction",
  "provider": "thinking-machines",
  "model": "thinkingmachines/Inkling-Small",
  "modelRevision": "pinned identifier",
  "packetRevision": "input packet identifier or null",
  "inputHashes": ["sha256:..."],
  "selectors": ["exact source span or region"],
  "proposalIds": ["..."],
  "parameters": { "temperature": 0, "thinkingEffort": "declared" },
  "generatedAt": "RFC-3339 timestamp",
  "reviewedBy": null,
  "canonicalWrite": false
}
```

## Reconsider this decision when

- Tinker's production inference exits beta with a documented SLA;
- Interveil has enough diverse labeled data to justify LoRA;
- privacy and retention terms meet the sovereignty promise;
- a smaller local model meets the release thresholds; or
- an independent provider materially outperforms Inkling-Small on Interveil's own held-out packets.

## Primary sources

- Thinking Machines Lab, [Inkling overview](https://thinkingmachines.ai/inkling/).
- Thinking Machines Lab, [Inkling model card](https://thinkingmachines.ai/model-card/inkling/).
- Tinker, [training API overview](https://tinker-docs.thinkingmachines.ai/tinker/).
- Tinker, [models and pricing](https://tinker-docs.thinkingmachines.ai/tinker/models/).
- Tinker, [OpenAI-compatible inference](https://tinker-docs.thinkingmachines.ai/tinker/compatible-apis/openai/).
- Tinker, [data model and permissions](https://tinker-docs.thinkingmachines.ai/tinker/data-model/).
- Thinking Machines Lab, [privacy notice](https://thinkingmachines.ai/legal/privacy/).
- Vercel AI SDK, [provider and model management](https://ai-sdk.dev/docs/ai-sdk-core/provider-management), [structured data](https://ai-sdk.dev/docs/ai-sdk-core/generating-structured-data), and [custom OpenAI-compatible providers](https://ai-sdk.dev/providers/openai-compatible-providers/custom-providers).

---

*The model lends horsepower. The person lends meaning and authority.*